csaf_suse - suse-su-2022:14910-1

Vulnerability from csaf_suse

Published

2022-03-14 16:25

Modified

2022-03-14 16:25

Summary

Security update for zsh

Notes

Title of the patch

Security update for zsh

Description of the patch

This update for zsh fixes the following issues: - CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting the PRIVILEGED option (bsc#1163882). - CVE-2018-13259: Fixed an unexpected truncation of long shebang lines (bsc#1107294). - CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991). - CVE-2018-1083: Fixed a stack-based buffer overflow when using tab completion on directories with long names (bsc#1087026). - CVE-2018-1071: Fixed a stack-based buffer overflow when executing certain commands (bsc#1084656). - CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296). - CVE-2017-18206: Fixed a buffer overflow related to symlink processing (bsc#1083002). - CVE-2017-18205: Fixed an application crash when using cd with no arguments (bsc#1082998). - CVE-2016-10714: Fixed a potential application crash when handling maximum length paths (bsc#1083250). - CVE-2014-10072: Fixed a buffer overflow when scanning very long directory paths for symbolic links (bsc#1082975). - CVE-2014-10071: Fixed a buffer overflow when redirecting output to a long file descriptor (bsc#1082977). - CVE-2014-10070: Fixed a privilege escalation vulnerability via environment variables (bsc#1082885).

Patchnames

sleposp3-zsh-14910,slessp4-zsh-14910

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for zsh",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for zsh fixes the following issues:\n\n- CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting\n  the PRIVILEGED option (bsc#1163882).\n- CVE-2018-13259: Fixed an unexpected truncation of long shebang lines (bsc#1107294).\n- CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991).\n- CVE-2018-1083: Fixed a stack-based buffer overflow when using tab completion\n  on directories with long names (bsc#1087026).\n- CVE-2018-1071: Fixed a stack-based buffer overflow when executing certain\n  commands (bsc#1084656).\n- CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296).\n- CVE-2017-18206: Fixed a buffer overflow related to symlink processing (bsc#1083002).\n- CVE-2017-18205: Fixed an application crash when using cd with no\n  arguments (bsc#1082998).\n- CVE-2016-10714: Fixed a potential application crash when handling maximum\n  length paths (bsc#1083250).\n- CVE-2014-10072: Fixed a buffer overflow when scanning very long directory\n  paths for symbolic links (bsc#1082975).\n- CVE-2014-10071: Fixed a buffer overflow when redirecting output to a long\n  file descriptor (bsc#1082977).\n- CVE-2014-10070: Fixed a privilege escalation vulnerability via environment\n  variables (bsc#1082885).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "sleposp3-zsh-14910,slessp4-zsh-14910",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_14910-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:14910-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:14910-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-March/010436.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1082885",
            url: "https://bugzilla.suse.com/1082885",
         },
         {
            category: "self",
            summary: "SUSE Bug 1082975",
            url: "https://bugzilla.suse.com/1082975",
         },
         {
            category: "self",
            summary: "SUSE Bug 1082977",
            url: "https://bugzilla.suse.com/1082977",
         },
         {
            category: "self",
            summary: "SUSE Bug 1082991",
            url: "https://bugzilla.suse.com/1082991",
         },
         {
            category: "self",
            summary: "SUSE Bug 1082998",
            url: "https://bugzilla.suse.com/1082998",
         },
         {
            category: "self",
            summary: "SUSE Bug 1083002",
            url: "https://bugzilla.suse.com/1083002",
         },
         {
            category: "self",
            summary: "SUSE Bug 1083250",
            url: "https://bugzilla.suse.com/1083250",
         },
         {
            category: "self",
            summary: "SUSE Bug 1084656",
            url: "https://bugzilla.suse.com/1084656",
         },
         {
            category: "self",
            summary: "SUSE Bug 1087026",
            url: "https://bugzilla.suse.com/1087026",
         },
         {
            category: "self",
            summary: "SUSE Bug 1107294",
            url: "https://bugzilla.suse.com/1107294",
         },
         {
            category: "self",
            summary: "SUSE Bug 1107296",
            url: "https://bugzilla.suse.com/1107296",
         },
         {
            category: "self",
            summary: "SUSE Bug 1163882",
            url: "https://bugzilla.suse.com/1163882",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2014-10070 page",
            url: "https://www.suse.com/security/cve/CVE-2014-10070/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2014-10071 page",
            url: "https://www.suse.com/security/cve/CVE-2014-10071/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2014-10072 page",
            url: "https://www.suse.com/security/cve/CVE-2014-10072/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-10714 page",
            url: "https://www.suse.com/security/cve/CVE-2016-10714/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-18205 page",
            url: "https://www.suse.com/security/cve/CVE-2017-18205/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2017-18206 page",
            url: "https://www.suse.com/security/cve/CVE-2017-18206/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-0502 page",
            url: "https://www.suse.com/security/cve/CVE-2018-0502/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1071 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1071/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-1083 page",
            url: "https://www.suse.com/security/cve/CVE-2018-1083/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-13259 page",
            url: "https://www.suse.com/security/cve/CVE-2018-13259/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-7549 page",
            url: "https://www.suse.com/security/cve/CVE-2018-7549/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-20044 page",
            url: "https://www.suse.com/security/cve/CVE-2019-20044/",
         },
      ],
      title: "Security update for zsh",
      tracking: {
         current_release_date: "2022-03-14T16:25:48Z",
         generator: {
            date: "2022-03-14T16:25:48Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:14910-1",
         initial_release_date: "2022-03-14T16:25:48Z",
         revision_history: [
            {
               date: "2022-03-14T16:25:48Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "zsh-4.3.6-67.9.8.1.i586",
                        product: {
                           name: "zsh-4.3.6-67.9.8.1.i586",
                           product_id: "zsh-4.3.6-67.9.8.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "zsh-4.3.6-67.9.8.1.ppc64",
                        product: {
                           name: "zsh-4.3.6-67.9.8.1.ppc64",
                           product_id: "zsh-4.3.6-67.9.8.1.ppc64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "zsh-4.3.6-67.9.8.1.s390x",
                        product: {
                           name: "zsh-4.3.6-67.9.8.1.s390x",
                           product_id: "zsh-4.3.6-67.9.8.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "zsh-4.3.6-67.9.8.1.x86_64",
                        product: {
                           name: "zsh-4.3.6-67.9.8.1.x86_64",
                           product_id: "zsh-4.3.6-67.9.8.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Point of Sale 11 SP3",
                        product: {
                           name: "SUSE Linux Enterprise Point of Sale 11 SP3",
                           product_id: "SUSE Linux Enterprise Point of Sale 11 SP3",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-pos:11:sp3",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 11 SP4-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise Server 11 SP4-LTSS",
                           product_id: "SUSE Linux Enterprise Server 11 SP4-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:suse_sles:11:sp4",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "zsh-4.3.6-67.9.8.1.i586 as component of SUSE Linux Enterprise Point of Sale 11 SP3",
               product_id: "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
            },
            product_reference: "zsh-4.3.6-67.9.8.1.i586",
            relates_to_product_reference: "SUSE Linux Enterprise Point of Sale 11 SP3",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "zsh-4.3.6-67.9.8.1.i586 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
            },
            product_reference: "zsh-4.3.6-67.9.8.1.i586",
            relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "zsh-4.3.6-67.9.8.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
            },
            product_reference: "zsh-4.3.6-67.9.8.1.ppc64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "zsh-4.3.6-67.9.8.1.s390x as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
            },
            product_reference: "zsh-4.3.6-67.9.8.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "zsh-4.3.6-67.9.8.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4-LTSS",
               product_id: "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            },
            product_reference: "zsh-4.3.6-67.9.8.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 11 SP4-LTSS",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2014-10070",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2014-10070",
            },
         ],
         notes: [
            {
               category: "general",
               text: "zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where \"env_reset\" has been disabled.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2014-10070",
               url: "https://www.suse.com/security/cve/CVE-2014-10070",
            },
            {
               category: "external",
               summary: "SUSE Bug 1082885 for CVE-2014-10070",
               url: "https://bugzilla.suse.com/1082885",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2014-10070",
               url: "https://bugzilla.suse.com/1200039",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200209 for CVE-2014-10070",
               url: "https://bugzilla.suse.com/1200209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.6,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "important",
            },
         ],
         title: "CVE-2014-10070",
      },
      {
         cve: "CVE-2014-10071",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2014-10071",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the \">& fd\" syntax.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2014-10071",
               url: "https://www.suse.com/security/cve/CVE-2014-10071",
            },
            {
               category: "external",
               summary: "SUSE Bug 1082977 for CVE-2014-10071",
               url: "https://bugzilla.suse.com/1082977",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2014-10071",
               url: "https://bugzilla.suse.com/1200039",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "moderate",
            },
         ],
         title: "CVE-2014-10071",
      },
      {
         cve: "CVE-2014-10072",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2014-10072",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2014-10072",
               url: "https://www.suse.com/security/cve/CVE-2014-10072",
            },
            {
               category: "external",
               summary: "SUSE Bug 1082975 for CVE-2014-10072",
               url: "https://bugzilla.suse.com/1082975",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2014-10072",
               url: "https://bugzilla.suse.com/1200039",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "moderate",
            },
         ],
         title: "CVE-2014-10072",
      },
      {
         cve: "CVE-2016-10714",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-10714",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-10714",
               url: "https://www.suse.com/security/cve/CVE-2016-10714",
            },
            {
               category: "external",
               summary: "SUSE Bug 1083250 for CVE-2016-10714",
               url: "https://bugzilla.suse.com/1083250",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2016-10714",
               url: "https://bugzilla.suse.com/1200039",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "low",
            },
         ],
         title: "CVE-2016-10714",
      },
      {
         cve: "CVE-2017-18205",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-18205",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-18205",
               url: "https://www.suse.com/security/cve/CVE-2017-18205",
            },
            {
               category: "external",
               summary: "SUSE Bug 1082998 for CVE-2017-18205",
               url: "https://bugzilla.suse.com/1082998",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2017-18205",
               url: "https://bugzilla.suse.com/1200039",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 2.5,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "low",
            },
         ],
         title: "CVE-2017-18205",
      },
      {
         cve: "CVE-2017-18206",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2017-18206",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2017-18206",
               url: "https://www.suse.com/security/cve/CVE-2017-18206",
            },
            {
               category: "external",
               summary: "SUSE Bug 1083002 for CVE-2017-18206",
               url: "https://bugzilla.suse.com/1083002",
            },
            {
               category: "external",
               summary: "SUSE Bug 1215218 for CVE-2017-18206",
               url: "https://bugzilla.suse.com/1215218",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "moderate",
            },
         ],
         title: "CVE-2017-18206",
      },
      {
         cve: "CVE-2018-0502",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-0502",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-0502",
               url: "https://www.suse.com/security/cve/CVE-2018-0502",
            },
            {
               category: "external",
               summary: "SUSE Bug 1107296 for CVE-2018-0502",
               url: "https://bugzilla.suse.com/1107296",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194009 for CVE-2018-0502",
               url: "https://bugzilla.suse.com/1194009",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194012 for CVE-2018-0502",
               url: "https://bugzilla.suse.com/1194012",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2018-0502",
               url: "https://bugzilla.suse.com/1200039",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200209 for CVE-2018-0502",
               url: "https://bugzilla.suse.com/1200209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "important",
            },
         ],
         title: "CVE-2018-0502",
      },
      {
         cve: "CVE-2018-1071",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1071",
            },
         ],
         notes: [
            {
               category: "general",
               text: "zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1071",
               url: "https://www.suse.com/security/cve/CVE-2018-1071",
            },
            {
               category: "external",
               summary: "SUSE Bug 1084656 for CVE-2018-1071",
               url: "https://bugzilla.suse.com/1084656",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2018-1071",
               url: "https://bugzilla.suse.com/1200039",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "low",
            },
         ],
         title: "CVE-2018-1071",
      },
      {
         cve: "CVE-2018-1083",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-1083",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-1083",
               url: "https://www.suse.com/security/cve/CVE-2018-1083",
            },
            {
               category: "external",
               summary: "SUSE Bug 1087026 for CVE-2018-1083",
               url: "https://bugzilla.suse.com/1087026",
            },
            {
               category: "external",
               summary: "SUSE Bug 1189668 for CVE-2018-1083",
               url: "https://bugzilla.suse.com/1189668",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200209 for CVE-2018-1083",
               url: "https://bugzilla.suse.com/1200209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-1083",
      },
      {
         cve: "CVE-2018-13259",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-13259",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-13259",
               url: "https://www.suse.com/security/cve/CVE-2018-13259",
            },
            {
               category: "external",
               summary: "SUSE Bug 1107294 for CVE-2018-13259",
               url: "https://bugzilla.suse.com/1107294",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194009 for CVE-2018-13259",
               url: "https://bugzilla.suse.com/1194009",
            },
            {
               category: "external",
               summary: "SUSE Bug 1194012 for CVE-2018-13259",
               url: "https://bugzilla.suse.com/1194012",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2018-13259",
               url: "https://bugzilla.suse.com/1200039",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200209 for CVE-2018-13259",
               url: "https://bugzilla.suse.com/1200209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "important",
            },
         ],
         title: "CVE-2018-13259",
      },
      {
         cve: "CVE-2018-7549",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-7549",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-7549",
               url: "https://www.suse.com/security/cve/CVE-2018-7549",
            },
            {
               category: "external",
               summary: "SUSE Bug 1082991 for CVE-2018-7549",
               url: "https://bugzilla.suse.com/1082991",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2018-7549",
               url: "https://bugzilla.suse.com/1200039",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "low",
            },
         ],
         title: "CVE-2018-7549",
      },
      {
         cve: "CVE-2019-20044",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-20044",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
               "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-20044",
               url: "https://www.suse.com/security/cve/CVE-2019-20044",
            },
            {
               category: "external",
               summary: "SUSE Bug 1163882 for CVE-2019-20044",
               url: "https://bugzilla.suse.com/1163882",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200039 for CVE-2019-20044",
               url: "https://bugzilla.suse.com/1200039",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200202 for CVE-2019-20044",
               url: "https://bugzilla.suse.com/1200202",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200209 for CVE-2019-20044",
               url: "https://bugzilla.suse.com/1200209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Point of Sale 11 SP3:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.i586",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.ppc64",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.s390x",
                  "SUSE Linux Enterprise Server 11 SP4-LTSS:zsh-4.3.6-67.9.8.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-03-14T16:25:48Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-20044",
      },
   ],
}

cve-2014-10072

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-06 14:02

Severity ?

Summary

In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.

References

▼	URL	Tags
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:1932	vendor-advisory, x_refsource_REDHAT
	https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T14:02:38.219Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  name: "RHSA-2018:1932",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:1932",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-10-31T09:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               name: "RHSA-2018:1932",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:1932",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2014-10072",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "RHSA-2018:1932",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:1932",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/3e06aeabd8a9e8384ebaa8b08996cd1f64737210",
                  },
                  {
                     name: "RHSA-2018:3073",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3073",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2014-10072",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-06T14:02:38.219Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-20044

Vulnerability from cvelistv5

Published

2020-02-24 13:09

Modified

2024-08-05 02:32

Severity ?

Summary

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

References

▼	URL	Tags
	http://zsh.sourceforge.net/releases.html	x_refsource_MISC
	https://github.com/XMB5/zsh-privileged-upgrade	x_refsource_MISC
	https://www.zsh.org/mla/zsh-announce/141	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2020/03/msg00004.html	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202003-55	vendor-advisory, x_refsource_GENTOO
	https://support.apple.com/kb/HT211170	x_refsource_CONFIRM
	https://support.apple.com/kb/HT211175	x_refsource_CONFIRM
	https://support.apple.com/kb/HT211171	x_refsource_CONFIRM
	https://support.apple.com/kb/HT211168	x_refsource_CONFIRM
	http://seclists.org/fulldisclosure/2020/May/49	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2020/May/55	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2020/May/53	mailing-list, x_refsource_FULLDISC
	http://seclists.org/fulldisclosure/2020/May/59	mailing-list, x_refsource_FULLDISC
	https://support.apple.com/HT211168	x_refsource_CONFIRM
	https://support.apple.com/HT211170	x_refsource_CONFIRM
	https://support.apple.com/HT211171	x_refsource_CONFIRM
	https://support.apple.com/HT211175	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T02:32:10.480Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://zsh.sourceforge.net/releases.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/XMB5/zsh-privileged-upgrade",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zsh.org/mla/zsh-announce/141",
               },
               {
                  name: "[debian-lts-announce] 20200302 [SECURITY] [DLA 2117-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/03/msg00004.html",
               },
               {
                  name: "FEDORA-2020-3f38f3e517",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/",
               },
               {
                  name: "FEDORA-2020-9009363f0f",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/",
               },
               {
                  name: "GLSA-202003-55",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-55",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT211170",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT211175",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT211171",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT211168",
               },
               {
                  name: "20200529 APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/May/49",
               },
               {
                  name: "20200529 APPLE-SA-2020-05-26-5 watchOS 6.2.5",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/May/55",
               },
               {
                  name: "20200529 APPLE-SA-2020-05-26-3 macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/May/53",
               },
               {
                  name: "20200529 APPLE-SA-2020-05-26-4 tvOS 13.4.5",
                  tags: [
                     "mailing-list",
                     "x_refsource_FULLDISC",
                     "x_transferred",
                  ],
                  url: "http://seclists.org/fulldisclosure/2020/May/59",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/HT211168",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/HT211170",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/HT211171",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/HT211175",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-01T06:06:16",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://zsh.sourceforge.net/releases.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/XMB5/zsh-privileged-upgrade",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zsh.org/mla/zsh-announce/141",
            },
            {
               name: "[debian-lts-announce] 20200302 [SECURITY] [DLA 2117-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/03/msg00004.html",
            },
            {
               name: "FEDORA-2020-3f38f3e517",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/",
            },
            {
               name: "FEDORA-2020-9009363f0f",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/",
            },
            {
               name: "GLSA-202003-55",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-55",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/kb/HT211170",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/kb/HT211175",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/kb/HT211171",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/kb/HT211168",
            },
            {
               name: "20200529 APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/May/49",
            },
            {
               name: "20200529 APPLE-SA-2020-05-26-5 watchOS 6.2.5",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/May/55",
            },
            {
               name: "20200529 APPLE-SA-2020-05-26-3 macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/May/53",
            },
            {
               name: "20200529 APPLE-SA-2020-05-26-4 tvOS 13.4.5",
               tags: [
                  "mailing-list",
                  "x_refsource_FULLDISC",
               ],
               url: "http://seclists.org/fulldisclosure/2020/May/59",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/HT211168",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/HT211170",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/HT211171",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/HT211175",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2019-20044",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://zsh.sourceforge.net/releases.html",
                     refsource: "MISC",
                     url: "http://zsh.sourceforge.net/releases.html",
                  },
                  {
                     name: "https://github.com/XMB5/zsh-privileged-upgrade",
                     refsource: "MISC",
                     url: "https://github.com/XMB5/zsh-privileged-upgrade",
                  },
                  {
                     name: "https://www.zsh.org/mla/zsh-announce/141",
                     refsource: "MISC",
                     url: "https://www.zsh.org/mla/zsh-announce/141",
                  },
                  {
                     name: "[debian-lts-announce] 20200302 [SECURITY] [DLA 2117-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/03/msg00004.html",
                  },
                  {
                     name: "FEDORA-2020-3f38f3e517",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/",
                  },
                  {
                     name: "FEDORA-2020-9009363f0f",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/",
                  },
                  {
                     name: "GLSA-202003-55",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-55",
                  },
                  {
                     name: "https://support.apple.com/kb/HT211170",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/kb/HT211170",
                  },
                  {
                     name: "https://support.apple.com/kb/HT211175",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/kb/HT211175",
                  },
                  {
                     name: "https://support.apple.com/kb/HT211171",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/kb/HT211171",
                  },
                  {
                     name: "https://support.apple.com/kb/HT211168",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/kb/HT211168",
                  },
                  {
                     name: "20200529 APPLE-SA-2020-05-26-1 iOS 13.5 and iPadOS 13.5",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/May/49",
                  },
                  {
                     name: "20200529 APPLE-SA-2020-05-26-5 watchOS 6.2.5",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/May/55",
                  },
                  {
                     name: "20200529 APPLE-SA-2020-05-26-3 macOS Catalina 10.15.5, Security Update 2020-003 Mojave, Security Update 2020-003 High Sierra",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/May/53",
                  },
                  {
                     name: "20200529 APPLE-SA-2020-05-26-4 tvOS 13.4.5",
                     refsource: "FULLDISC",
                     url: "http://seclists.org/fulldisclosure/2020/May/59",
                  },
                  {
                     name: "https://support.apple.com/HT211168",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/HT211168",
                  },
                  {
                     name: "https://support.apple.com/HT211170",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/HT211170",
                  },
                  {
                     name: "https://support.apple.com/HT211171",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/HT211171",
                  },
                  {
                     name: "https://support.apple.com/HT211175",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/HT211175",
                  },
                  {
                     name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2019-20044",
      datePublished: "2020-02-24T13:09:43",
      dateReserved: "2019-12-27T00:00:00",
      dateUpdated: "2024-08-05T02:32:10.480Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1071

Vulnerability from cvelistv5

Published

2018-03-09 15:00

Modified

2024-08-05 03:51

Severity ?

Summary

zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1553531	x_refsource_CONFIRM
	https://usn.ubuntu.com/3608-1/	vendor-advisory, x_refsource_UBUNTU
	http://www.securityfocus.com/bid/103359	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201805-10	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	zsh	zsh	Version: 5.4.2

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:51:48.907Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1553531",
               },
               {
                  name: "USN-3608-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3608-1/",
               },
               {
                  name: "103359",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/103359",
               },
               {
                  name: "GLSA-201805-10",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201805-10",
               },
               {
                  name: "[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "zsh",
               vendor: "zsh",
               versions: [
                  {
                     status: "affected",
                     version: "5.4.2",
                  },
               ],
            },
         ],
         datePublic: "2018-03-08T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-121",
                     description: "CWE-121",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-01T06:06:18",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1553531",
            },
            {
               name: "USN-3608-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3608-1/",
            },
            {
               name: "103359",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/103359",
            },
            {
               name: "GLSA-201805-10",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201805-10",
            },
            {
               name: "[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-1071",
      datePublished: "2018-03-09T15:00:00Z",
      dateReserved: "2017-12-04T00:00:00",
      dateUpdated: "2024-08-05T03:51:48.907Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-10070

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-06 14:02

Severity ?

Summary

zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.

References

▼	URL	Tags
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72	x_refsource_MISC
	http://zsh.sourceforge.net/releases.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T14:02:38.191Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://zsh.sourceforge.net/releases.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where \"env_reset\" has been disabled.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-03-20T09:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://zsh.sourceforge.net/releases.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2014-10070",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where \"env_reset\" has been disabled.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/546203a770cec329e73781c3c8ab1078390aee72",
                  },
                  {
                     name: "http://zsh.sourceforge.net/releases.html",
                     refsource: "MISC",
                     url: "http://zsh.sourceforge.net/releases.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2014-10070",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-06T14:02:38.191Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-1083

Vulnerability from cvelistv5

Published

2018-03-28 13:00

Modified

2024-09-16 18:13

Severity ?

Summary

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.

References

▼	URL	Tags
	https://usn.ubuntu.com/3608-1/	vendor-advisory, x_refsource_UBUNTU
	http://www.securityfocus.com/bid/103572	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201805-10	vendor-advisory, x_refsource_GENTOO
	https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:1932	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=1557382	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html	mailing-list, x_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	zsh	zsh	Version: before zsh 5.4.2-test-1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:51:48.910Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3608-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3608-1/",
               },
               {
                  name: "103572",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/103572",
               },
               {
                  name: "GLSA-201805-10",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201805-10",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7",
               },
               {
                  name: "RHSA-2018:1932",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:1932",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1557382",
               },
               {
                  name: "[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "zsh",
               vendor: "zsh",
               versions: [
                  {
                     status: "affected",
                     version: "before zsh 5.4.2-test-1",
                  },
               ],
            },
         ],
         datePublic: "2018-03-26T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-120",
                     description: "CWE-120->CWE-121",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-01T06:06:17",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "USN-3608-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3608-1/",
            },
            {
               name: "103572",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/103572",
            },
            {
               name: "GLSA-201805-10",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201805-10",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7",
            },
            {
               name: "RHSA-2018:1932",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:1932",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1557382",
            },
            {
               name: "[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2018-03-26T00:00:00",
               ID: "CVE-2018-1083",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "zsh",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "before zsh 5.4.2-test-1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "zsh",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mentioned path. If the user affected is privileged, this leads to privilege escalation.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-120->CWE-121",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3608-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3608-1/",
                  },
                  {
                     name: "103572",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/103572",
                  },
                  {
                     name: "GLSA-201805-10",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201805-10",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7",
                     refsource: "CONFIRM",
                     url: "https://sourceforge.net/p/zsh/code/ci/259ac472eac291c8c103c7a0d8a4eaf3c2942ed7",
                  },
                  {
                     name: "RHSA-2018:1932",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:1932",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1557382",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1557382",
                  },
                  {
                     name: "[debian-lts-announce] 20180331 [SECURITY] [DLA 1335-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/03/msg00038.html",
                  },
                  {
                     name: "RHSA-2018:3073",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3073",
                  },
                  {
                     name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-1083",
      datePublished: "2018-03-28T13:00:00Z",
      dateReserved: "2017-12-04T00:00:00",
      dateUpdated: "2024-09-16T18:13:29.080Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-10071

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-06 14:02

Severity ?

Summary

In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.

References

▼	URL	Tags
	https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055	x_refsource_MISC
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T14:02:38.246Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055",
               },
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the \">& fd\" syntax.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-10-31T09:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055",
            },
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2014-10071",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the \">& fd\" syntax.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055",
                  },
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "RHSA-2018:3073",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3073",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2014-10071",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-06T14:02:38.246Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-18206

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-05 21:13

Severity ?

Summary

In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.

References

▼	URL	Tags
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/201805-10	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2018:1932	vendor-advisory, x_refsource_REDHAT
	https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T21:13:49.110Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  name: "GLSA-201805-10",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201805-10",
               },
               {
                  name: "RHSA-2018:1932",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:1932",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-01T06:06:19",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               name: "GLSA-201805-10",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201805-10",
            },
            {
               name: "RHSA-2018:1932",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:1932",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2017-18206",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In utils.c in zsh before 5.4, symlink expansion had a buffer overflow.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "GLSA-201805-10",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201805-10",
                  },
                  {
                     name: "RHSA-2018:1932",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:1932",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d",
                  },
                  {
                     name: "RHSA-2018:3073",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3073",
                  },
                  {
                     name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-18206",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-05T21:13:49.110Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-18205

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-05 21:13

Severity ?

Summary

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.

References

▼	URL	Tags
	https://sourceforge.net/p/zsh/code/ci/eb783754bdb74377f3cea4ceca9c23a02ea1bf58	x_refsource_MISC
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/201805-10	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T21:13:49.111Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/eb783754bdb74377f3cea4ceca9c23a02ea1bf58",
               },
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  name: "GLSA-201805-10",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201805-10",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-10-31T09:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/eb783754bdb74377f3cea4ceca9c23a02ea1bf58",
            },
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               name: "GLSA-201805-10",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201805-10",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2017-18205",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processing of the cd command with no argument if HOME is not set.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/eb783754bdb74377f3cea4ceca9c23a02ea1bf58",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/eb783754bdb74377f3cea4ceca9c23a02ea1bf58",
                  },
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "GLSA-201805-10",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201805-10",
                  },
                  {
                     name: "RHSA-2018:3073",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3073",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2017-18205",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-05T21:13:49.111Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-0502

Vulnerability from cvelistv5

Published

2018-09-05 07:00

Modified

2024-08-05 03:28

Severity ?

Summary

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.

References

▼	URL	Tags
	https://bugs.debian.org/908000	x_refsource_MISC
	https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d	x_refsource_MISC
	https://www.zsh.org/mla/zsh-announce/136	x_refsource_MISC
	https://usn.ubuntu.com/3764-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/201903-02	vendor-advisory, x_refsource_GENTOO
	https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	zsh before 5.6	Version: zsh before 5.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T03:28:11.019Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.debian.org/908000",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zsh.org/mla/zsh-announce/136",
               },
               {
                  name: "USN-3764-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3764-1/",
               },
               {
                  name: "GLSA-201903-02",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201903-02",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "zsh before 5.6",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "zsh before 5.6",
                  },
               ],
            },
         ],
         datePublic: "2018-09-05T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "improper parsing",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-01T06:06:17",
            orgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
            shortName: "debian",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.debian.org/908000",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zsh.org/mla/zsh-announce/136",
            },
            {
               name: "USN-3764-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3764-1/",
            },
            {
               name: "GLSA-201903-02",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201903-02",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@debian.org",
               ID: "CVE-2018-0502",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "zsh before 5.6",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "zsh before 5.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "improper parsing",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugs.debian.org/908000",
                     refsource: "MISC",
                     url: "https://bugs.debian.org/908000",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
                  },
                  {
                     name: "https://www.zsh.org/mla/zsh-announce/136",
                     refsource: "MISC",
                     url: "https://www.zsh.org/mla/zsh-announce/136",
                  },
                  {
                     name: "USN-3764-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3764-1/",
                  },
                  {
                     name: "GLSA-201903-02",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201903-02",
                  },
                  {
                     name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
      assignerShortName: "debian",
      cveId: "CVE-2018-0502",
      datePublished: "2018-09-05T07:00:00",
      dateReserved: "2017-11-27T00:00:00",
      dateUpdated: "2024-08-05T03:28:11.019Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-13259

Vulnerability from cvelistv5

Published

2018-09-05 07:00

Modified

2024-08-05 09:00

Severity ?

Summary

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

References

▼	URL	Tags
	https://bugs.debian.org/908000	x_refsource_MISC
	https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d	x_refsource_MISC
	https://www.zsh.org/mla/zsh-announce/136	x_refsource_MISC
	https://usn.ubuntu.com/3764-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/201903-02	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2019:2017	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	zsh before 5.6	Version: zsh before 5.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T09:00:34.510Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugs.debian.org/908000",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zsh.org/mla/zsh-announce/136",
               },
               {
                  name: "USN-3764-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3764-1/",
               },
               {
                  name: "GLSA-201903-02",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201903-02",
               },
               {
                  name: "RHSA-2019:2017",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2017",
               },
               {
                  name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "zsh before 5.6",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "zsh before 5.6",
                  },
               ],
            },
         ],
         datePublic: "2018-09-05T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "improper parsing",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-01T06:06:14",
            orgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
            shortName: "debian",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugs.debian.org/908000",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zsh.org/mla/zsh-announce/136",
            },
            {
               name: "USN-3764-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3764-1/",
            },
            {
               name: "GLSA-201903-02",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201903-02",
            },
            {
               name: "RHSA-2019:2017",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2017",
            },
            {
               name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@debian.org",
               ID: "CVE-2018-13259",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "zsh before 5.6",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "zsh before 5.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "improper parsing",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugs.debian.org/908000",
                     refsource: "MISC",
                     url: "https://bugs.debian.org/908000",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d",
                  },
                  {
                     name: "https://www.zsh.org/mla/zsh-announce/136",
                     refsource: "MISC",
                     url: "https://www.zsh.org/mla/zsh-announce/136",
                  },
                  {
                     name: "USN-3764-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3764-1/",
                  },
                  {
                     name: "GLSA-201903-02",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201903-02",
                  },
                  {
                     name: "RHSA-2019:2017",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2017",
                  },
                  {
                     name: "[debian-lts-announce] 20201201 [SECURITY] [DLA 2470-1] zsh security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
      assignerShortName: "debian",
      cveId: "CVE-2018-13259",
      datePublished: "2018-09-05T07:00:00",
      dateReserved: "2018-07-05T00:00:00",
      dateUpdated: "2024-08-05T09:00:34.510Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-7549

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-05 06:31

Severity ?

Summary

In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.

References

▼	URL	Tags
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://security.gentoo.org/glsa/201805-10	vendor-advisory, x_refsource_GENTOO
	https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2018:3073	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:31:04.386Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  name: "GLSA-201805-10",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201805-10",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd",
               },
               {
                  name: "RHSA-2018:3073",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3073",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-10-31T09:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               name: "GLSA-201805-10",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201805-10",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd",
            },
            {
               name: "RHSA-2018:3073",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3073",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-7549",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "GLSA-201805-10",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201805-10",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd",
                  },
                  {
                     name: "RHSA-2018:3073",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3073",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-7549",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-05T06:31:04.386Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-10714

Vulnerability from cvelistv5

Published

2018-02-27 22:00

Modified

2024-08-06 03:30

Severity ?

Summary

In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.

References

▼	URL	Tags
	https://usn.ubuntu.com/3593-1/	vendor-advisory, x_refsource_UBUNTU
	https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T03:30:20.143Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "USN-3593-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3593-1/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-02-27T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-03-20T09:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "USN-3593-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3593-1/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-10714",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "USN-3593-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3593-1/",
                  },
                  {
                     name: "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60",
                     refsource: "MISC",
                     url: "https://sourceforge.net/p/zsh/code/ci/a62e1640bcafbb82d86ea8d8ce057a83c4683d60",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-10714",
      datePublished: "2018-02-27T22:00:00",
      dateReserved: "2018-02-27T00:00:00",
      dateUpdated: "2024-08-06T03:30:20.143Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature